Bazel 8 support

Update protobuf to v29 – see https://protobuf.dev/news/v29/
Update tcmalloc to version supporting Bazel 8

- Remove incompatible flag overrides that are now on-by-default in Bazel

.bazelrc

@@ -14,9 +14,7 @@ build --test_timeout=1,15,60,240
 common --noenable_bzlmod
 
 # bazel7 enables Build without the Bytes (BwoB) by default. This significantly speeds up builds
-# using the remote cache since less data needs to be fetched. Set remote_cache_eviction_retries
-# which is required to fully support a "dumb" cache. Bazel 8 already sets this value by default.
-build --experimental_remote_cache_eviction_retries=5
+# using the remote cache since less data needs to be fetched.
 # Note that we use remote_download_minimal for test builds, which avoids fetching build outputs
 # where possible. While several previous BwoB bugs have been fixed, this is slower than it could be
 # due to https://github.com/bazelbuild/bazel/issues/20576.
@@ -33,12 +31,6 @@ import %workspace%/build/lint.bazelrc
 # Enable webgpu
 build --//src/workerd/io:enable_experimental_webgpu=True
 
-# Avoid generating duplicate runfile trees. This will become the default in a future bazel version.
-build --nolegacy_external_runfiles
-
-# Flip this early to avoid breaking compatibility once it becomes the default.
-build --incompatible_disallow_empty_glob
-
 # Prevents bazel cache invalidation when switching terminals
 build --incompatible_strict_action_env
 
@@ -380,3 +372,12 @@ build:windows --cxxopt='/Zc:__cplusplus' --host_cxxopt='/Zc:__cplusplus'
 # enable clang coverage: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html
 build:clang-coverage --copt="-fprofile-instr-generate" --linkopt="-fprofile-instr-generate"
 build:clang-coverage --copt="-fcoverage-mapping" --linkopt="-fcoverage-mapping"
+
+build --enable_workspace
+# As part of starlarkification, Bazel 8 removes a number of rules which now need to be imported from
+# other repositories. In the long term, load() statements will be needed to import these rules. For
+# now, we can still autoload the affected repositories when needed. Do this only for a few
+# handpicked rules_python rules_shell, and protobuf components instead of the larger default
+# autoload set – some dependencies aren't importing the required shell rules yet, but we don't want
+# to accidentally rely on autoloading more dependencies.
+build --incompatible_autoload_externally="+py_binary,+py_library,+py_test,+ProtoInfo,+sh_binary,+proto_library,+cc_proto_library"

.bazelversion

@@ -1 +1,2 @@
-7.4.1rc2
+6f7faa659e5eb3e56c8a6274ebcb86884703d603
+# Bazel release-8.1.0 branch

.github/workflows/test.yml

@@ -66,7 +66,8 @@ jobs:
       image: ${{ matrix.os.image }}
       os_name: ${{ matrix.os.name }}
       suffix: ${{ matrix.config.suffix }}
-      extra_bazel_args: "--config=ci-test"
+      # TODO: Debug Windows issues
+      extra_bazel_args: "--remote_download_all --noexperimental_inprocess_symlink_creation"
     secrets:
       BAZEL_CACHE_KEY: ${{ secrets.BAZEL_CACHE_KEY }}
       WORKERS_MIRROR_URL: ${{ secrets.WORKERS_MIRROR_URL }}

.gitignore

@@ -16,6 +16,8 @@ package-lock.json
 /external
 # Bazel output symlinks: Same reasoning as /external. You need the * because people can change the name of the directory your repository is cloned into, changing the bazel-<workspace_name> symlink.
 /bazel-*
+# Bazel 8's MODULE lock, since we're not actually locking anything yet.
+MODULE.bazel.lock
 # Compiled output -> don't check in
 /compile_commands.json
 /rust-project.json

MODULE.bazel

@@ -0,0 +1 @@
+# We don't use bzlmod at this time, but bazel 8 still expects us to have a MODULE.bazel file.

WORKSPACE

@@ -13,6 +13,11 @@ deps_gen()
 
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+
+rules_shell_dependencies()
+
+rules_shell_toolchains()
 
 NODE_VERSION = "22.11.0"
 
@@ -165,10 +170,10 @@ bind(
 # OK, now we can bring in tcmalloc itself.
 http_archive(
     name = "com_google_tcmalloc",
-    sha256 = "81f285cb337f445276f37c308cb90120f8ba4311d1be9daf3b93dccf4bfdba7d",
-    strip_prefix = "google-tcmalloc-69c409c",
+    integrity = "sha256-8joG3SxfLYqR2liUznBAcMkHKYMmUtsO1qGr505VBMY=",
+    strip_prefix = "google-tcmalloc-91765c1",
     type = "tgz",
-    url = "https://github.com/google/tcmalloc/tarball/69c409c344bdf894fc7aab83e2d9e280b009b2f3",
+    url = "https://github.com/google/tcmalloc/tarball/91765c11461a01579fcbdddf430a556b818818c4",
 )
 
 # ========================================================================================
@@ -267,6 +272,8 @@ esbuild_register_toolchains(
     esbuild_version = LATEST_ESBUILD_VERSION,
 )
 
+# TODO: Upstream 0021-bazel-Add-missing-imports-needed-with-Bazel-8.patch (currently unused here) to
+# avoid needing to autoload py_test.
 load("@//build/deps:v8.bzl", "deps_v8")
 
 deps_v8()

build/deps/build_deps.jsonc

@@ -125,6 +125,20 @@
       "repo": "rules_ts",
       "file_regex": "^rules_ts-"
     },
+    {
+      "name": "rules_shell",
+      "type": "github_release",
+      "owner": "bazelbuild",
+      "repo": "rules_shell",
+      "file_regex": "^rules_shell-"
+    },
+    {
+      "name": "rules_cc",
+      "type": "github_release",
+      "owner": "bazelbuild",
+      "repo": "rules_cc",
+      "file_regex": "^rules_cc-"
+    },
     //buildifier
     {
       "name": "buildifier-linux-amd64",

build/deps/gen/build_deps.bzl

@@ -23,10 +23,12 @@ load("@//build/deps:gen/dep_cxxbridge_cmd.bzl", "dep_cxxbridge_cmd")
 load("@//build/deps:gen/dep_ruff_darwin_arm64.bzl", "dep_ruff_darwin_arm64")
 load("@//build/deps:gen/dep_ruff_linux_amd64.bzl", "dep_ruff_linux_amd64")
 load("@//build/deps:gen/dep_ruff_linux_arm64.bzl", "dep_ruff_linux_arm64")
+load("@//build/deps:gen/dep_rules_cc.bzl", "dep_rules_cc")
 load("@//build/deps:gen/dep_rules_nodejs.bzl", "dep_rules_nodejs")
 load("@//build/deps:gen/dep_rules_pkg.bzl", "dep_rules_pkg")
 load("@//build/deps:gen/dep_rules_python.bzl", "dep_rules_python")
 load("@//build/deps:gen/dep_rules_rust.bzl", "dep_rules_rust")
+load("@//build/deps:gen/dep_rules_shell.bzl", "dep_rules_shell")
 load("@//build/deps:gen/dep_wpt.bzl", "dep_wpt")
 
 def deps_gen():
@@ -46,6 +48,8 @@ def deps_gen():
     dep_aspect_bazel_lib()
     dep_aspect_rules_js()
     dep_aspect_rules_ts()
+    dep_rules_shell()
+    dep_rules_cc()
     dep_buildifier_linux_amd64()
     dep_buildifier_linux_arm64()
     dep_buildifier_darwin_amd64()

build/deps/gen/dep_aspect_rules_js.bzl

@@ -2,10 +2,10 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-TAG_NAME = "v2.1.2"
-URL = "https://github.com/aspect-build/rules_js/releases/download/v2.1.2/rules_js-v2.1.2.tar.gz"
-STRIP_PREFIX = "rules_js-2.1.2"
-SHA256 = "fbc34d815a0cc52183a1a26732fc0329e26774a51abbe0f26fc9fd2dab6133b4"
+TAG_NAME = "v2.1.3"
+URL = "https://github.com/aspect-build/rules_js/releases/download/v2.1.3/rules_js-v2.1.3.tar.gz"
+STRIP_PREFIX = "rules_js-2.1.3"
+SHA256 = "875b8d01af629dbf626eddc5cf239c9f0da20330f4d99ad956afc961096448dd"
 TYPE = "tgz"
 
 def dep_aspect_rules_js():

build/deps/gen/dep_com_google_protobuf.bzl

@@ -2,10 +2,10 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-TAG_NAME = "v28.3"
-URL = "https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz"
-STRIP_PREFIX = "protobuf-28.3"
-SHA256 = "7c3ebd7aaedd86fa5dc479a0fda803f602caaf78d8aff7ce83b89e1b8ae7442a"
+TAG_NAME = "v29.3"
+URL = "https://github.com/protocolbuffers/protobuf/releases/download/v29.3/protobuf-29.3.tar.gz"
+STRIP_PREFIX = "protobuf-29.3"
+SHA256 = "008a11cc56f9b96679b4c285fd05f46d317d685be3ab524b2a310be0fbad987e"
 TYPE = "tgz"
 
 def dep_com_google_protobuf():

build/deps/gen/dep_rules_cc.bzl

@@ -0,0 +1,18 @@
+# WARNING: THIS FILE IS AUTOGENERATED BY update-deps.py DO NOT EDIT
+
+load("@//:build/http.bzl", "http_archive")
+
+TAG_NAME = "0.0.17"
+URL = "https://github.com/bazelbuild/rules_cc/releases/download/0.0.17/rules_cc-0.0.17.tar.gz"
+STRIP_PREFIX = "rules_cc-0.0.17"
+SHA256 = "abc605dd850f813bb37004b77db20106a19311a96b2da1c92b789da529d28fe1"
+TYPE = "tgz"
+
+def dep_rules_cc():
+    http_archive(
+        name = "rules_cc",
+        url = URL,
+        strip_prefix = STRIP_PREFIX,
+        type = TYPE,
+        sha256 = SHA256,
+    )

build/deps/gen/dep_rules_shell.bzl

@@ -0,0 +1,18 @@
+# WARNING: THIS FILE IS AUTOGENERATED BY update-deps.py DO NOT EDIT
+
+load("@//:build/http.bzl", "http_archive")
+
+TAG_NAME = "v0.3.0"
+URL = "https://github.com/bazelbuild/rules_shell/releases/download/v0.3.0/rules_shell-v0.3.0.tar.gz"
+STRIP_PREFIX = "rules_shell-0.3.0"
+SHA256 = "d8cd4a3a91fc1dc68d4c7d6b655f09def109f7186437e3f50a9b60ab436a0c53"
+TYPE = "tgz"
+
+def dep_rules_shell():
+    http_archive(
+        name = "rules_shell",
+        url = URL,
+        strip_prefix = STRIP_PREFIX,
+        type = TYPE,
+        sha256 = SHA256,
+    )

patches/v8/0021-bazel-Add-missing-imports-needed-with-Bazel-8.patch

@@ -0,0 +1,19 @@
+From c9688d31cd8e1e8cbb5624f9cee367029d5a728a Mon Sep 17 00:00:00 2001
+From: Felix Hanau <felix@cloudflare.com>
+Date: Sun, 27 Oct 2024 16:49:31 +0000
+Subject: [bazel] Add missing imports needed with Bazel 8
+
+
+diff --git a/BUILD.bazel b/BUILD.bazel
+index 3fa74551420b48f226553ddaa00eb9926a3b009f..5860920e592b2b22d44bbd6a62783fc472e4dcf7 100644
+--- a/BUILD.bazel
++++ b/BUILD.bazel
+@@ -3,7 +3,7 @@
+ # found in the LICENSE file.
+
+ load("@bazel_skylib//lib:selects.bzl", "selects")
+-load("@rules_python//python:defs.bzl", "py_binary")
++load("@rules_python//python:defs.bzl", "py_binary", "py_test")
+ load("@v8_python_deps//:requirements.bzl", "requirement")
+ load(
+     "@v8//:bazel/defs.bzl",

src/workerd/server/tests/compile-tests/BUILD.bazel

@@ -1,3 +1,5 @@
+load("@rules_shell//shell:sh_test.bzl", "sh_test")
+
 sh_test(
     name = "helloworld_compile_test",
     size = "medium",